If you discover a security vulnerability in any example code, script, or configuration in this repository, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, contact the maintainer directly via the GitHub Security Advisories feature or by email (visible on the GitHub profile).

Please include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested remediation if known

This repository contains educational and lab content only. None of the examples are intended for direct production use without thorough review and adaptation.

Never commit secrets, credentials, tokens, or passwords to this repository.

This includes:

• API keys
• Passwords
• Tokens
• Private keys
• Connection strings containing credentials

Use obviously fake placeholder values such as REPLACE_ME or <your-value-here> in all examples.

GitHub secret scanning is enabled on this repository. Push protection will block commits containing recognised secret patterns.

Before committing, review all files for secrets using tools such as:

# Install truffleHog or gitleaks locally for pre-commit scanning
gitleaks detect --source . --verbose

Use .env files for local development secrets. These files are excluded from version control via .gitignore.

Never reference .env file values directly in YAML or code that is committed.

Kubernetes Secret resources in this repository use placeholder values only.

# Example: Placeholder only — do not use real values
apiVersion: v1
kind: Secret
metadata:
  name: example-secret
type: Opaque
stringData:
  username: REPLACE_ME
  password: REPLACE_ME

Kubernetes Secrets are base64-encoded, not encrypted at rest by default.

For production workloads, prefer:

• External Secrets Operator
• HashiCorp Vault
• Sealed Secrets
• Cloud provider secret managers (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault)

All container images used in examples should:

• Come from trusted, official sources
• Be pinned to a specific digest or tag
• Be regularly updated
• Be scanned for vulnerabilities before use in sensitive environments

Use lightweight images such as nginx:alpine, busybox, or official distroless images where possible.

All Kubernetes manifests in this repository follow the principle of least privilege:

• Containers run as non-root users where possible
• allowPrivilegeEscalation: false is set where applicable
• Linux capabilities are dropped where possible
• Read-only root filesystems are used where practical
• Resource requests and limits are defined

ServiceAccounts and RBAC configurations use minimal required permissions. Avoid using cluster-admin unless explicitly required by an exercise, and clearly document why.

• Pin GitHub Actions to specific commit SHAs or major version tags
• Review third-party dependencies before adding them
• Use go mod verify to validate Go module checksums
• Keep dependencies updated

Dependencies in Go modules and other tooling should be kept up to date. Consider enabling GitHub Dependabot alerts for this repository.